and Céline Blondeau October 8, 2012 joint work with Benoît Gérard and Kaisa Nyberg Multiple differential cryptanalysis using LLR and October, 8 1/27
|
|
- Joel Parsons
- 5 years ago
- Views:
Transcription
1 Multiple differential cryptanalysis using LLR and Céline Blondeau joint work with Benoît Gérard and Kaisa Nyberg October 8, /27
2 Outline Introduction Block Ciphers Differential Cryptanalysis Last Round Attacks Multiple Differential Cryptanalysis Definition Partitioning Function Complexities Experiments Experimental Results Analyse 2/27
3 Outline Introduction Block Ciphers Differential Cryptanalysis Last Round Attacks Multiple Differential Cryptanalysis Definition Partitioning Function Complexities Experiments Experimental Results Analyse 3/27
4 Block ciphers x F K1 F K2 F Kr F Kr+1 y E K : F m 2! Fm 2 I K : Master key I F: Round function I K i : Round key cccc cccc cccc cccc S 3 S 2 S 1 S cccc cccc cccc cccc S 3 S 2 S 1 S cccc cccc cccc cccc S 3 S 2 S 1 S cccc cccc cccc cccc SMALLPRESENT-[4] 4/27
5 Statistical Attacks Statistical attacks: I Take advantage of a non-uniform behavior of the cipher I Two families: Linear and Differential cryptanalysis Improvement of differential cryptanalysis I Differential cryptanalysis [Biham Shamir 91] I Truncated differential cryptanalysis [Knudsen 95] I Impossible differential cryptanalysis [Biham Biryukov Shamir 99] I igher order differential cryptanalysis [Lai 94] [Knudsen 95] I Multiple differential cryptanalysis (First approach) [BG 11] 5/27
6 Linear cryptanalysis cccc cccc cccc ccccc S 3 S 2 S 1 S cccc cccc cccc ccccc S 3 S 2 S 1 S cccc cccc cccc ccccc S 3 S 2 S 1 S cccc cccc cccc cccc [Tardy-Gilbert91], [Matsui93] Linear relation using I plaintext bits, I key bits, I ciphertext bits. x apple K y = 0 with probability p = " 6/27
7 Differential Cryptanalysis Given an input difference between two plaintexts, some output differences occur more often than others. x - 6 E K - 6 y in out x 0?- E K?- y 0 Differential: pair of input and output difference ( in, out) Differential probability: p = P X,K [ E K (X) E K (X in) = out ] Uniform probability: = 2 m 7/27
8 Last Round Attack Distinguisher Plaintext F r K? r rounds Characteristic? Partial State 8/27
9 Last Round Attack Distinguisher F r K? r rounds Plaintext Characteristic? Partial State? S 7 S 6 S 5 S 4 S 3 S 2 S 1 S 0 k 7 k 6 k 5 k 4 k 3 k 2 k 1 k 0 e e e e e e e e Substitution Layer Key addition Ciphertext 8/27
10 Related Work Linear Cryptanalysis: I Multiple linear cryptanalysis [Baignères, Junod, Vaudenay 04] I Multidimensional linear cryptanalysis [ermelin, Cho, Nyberg 08] Both use LLR and/or 2 statistical tests. Differential Cryptanalysis: I [Blondeau, Gérard 11]: The frequencies are sum up I ere: We study the LLR and/or 2 statistical tests. 9/27
11 Multiple differential cryptanalysis (First Approach) I Set of differences in (v), out (v) I With probabilities p v = P X,K [ E K (X) E K (X (v) (v) in )= out ]. I Set of input differences in (v) 2 in. I p = 1 in P v p v expected probability. I = 1 in Pv 1 2 m uniform probability. 10/27
12 Outline Introduction Block Ciphers Differential Cryptanalysis Last Round Attacks Multiple Differential Cryptanalysis Definition Partitioning Function Complexities Experiments Experimental Results Analyse 11/27
13 Multiple Differential Cryptanalysis I Fix input difference in (To simplify the analysis) I Vector of difference : V =[ (i) out ] after r rounds, I p =[p v ] v2v vector of expected probabilities. I =[ v ] v2v vector of uniform probabilities. 12/27
14 Discussion Parallel Work for small ciphers: [Albrecht Leander 2012] Whole distribution taken for SMALLPRESENT-[4] (16-bit cipher) Whole distribution taken for KATAN-32 (32-bit cipher) Limits: For actual ciphers the output size is too large (2 64 or ) Application to real cipher: Introduction of partitioning functions. 13/27
15 Partitioning function We analyze two orthogonal cases I Unbalanced partitioning I Take a subset of simple differences I Balanced partitioning I Group the differences in order to be able to use information of the whole output space. 14/27
16 Unbalanced Partitioning Idea: Subset of simple differences I Output differences ( (i) out ) 1appleiappleA, I Counter for each of these differentials q k i. I As P A i=1 qk i 6= 1 I We have a trash counter q0 k differences. which gather all other output We increment the counter qi k if the difference (i) out is obtained after partial deciphering. 15/27
17 Unbalanced Partitioning: Last Round Attack in? V * Y V =[ (i) out ] i S 7 S 6 S 5 S 4 S 3 S 2 S 1 S 0 Substitution Layer k 7 k 6 k 5 k 4 k 3 k 2 k 1 k 0 e e e e e e e e 16/27
18 Unbalanced Partitioning: Last Round Attack V * Y V =[ (i) out ] i S 7 S 6 S 5 S 4 S 3 S 2 S 1 S 0 Active Sboxes k 7 k 6 k 5 k 4 k 3 k 2 k 1 k 0 e e e e e e e e 16/27
19 Unbalanced Partitioning: Last Round Attack V * Y S 7 S 6 S 5 S 4 S 3 S 2 S 1 S 0 k 7 k 6 k 5 k 4 k 3 k 2 k 1 k 0 e e e e e e e e Sieving process Discard some ciphertext pairs 16/27
20 Unbalanced Partitioning: Last Round Attack V * 6 S 7 S 6 S 5 S 4 S 3 S 2 S 1 S 0 k 7 e k 6 e k 5 e k 4 6 e k 3 6 e k 2 e k 1 6 e k 0 e For all key candidates, partially decipher 16/27
21 Unbalanced Partitioning: Last Round Attack V * 6 If = (i) out S 7 S 6 S 5 S 4 S 3 S 2 S 1 S 0 Increment qi k k 7 e k 6 e k 5 e k 4 6 e k 3 6 e k 2 e k 1 6 e k 0 e Otherwise Increment q0 k 16/27
22 Unbalanced Partitioning: Last Round Attack V * 6 If = (i) out S 7 S 6 S 5 S 4 S 3 S 2 S 1 S 0 Increment qi k k 7 e k 6 e k 5 e k 4 6 e k 3 6 e k 2 e k 1 6 e k 0 e Otherwise Increment q0 k Analyse the vectors q k for each key Scoring function 16/27
23 Unbalanced Partionning: Remarks Corresponding known/former attacks: I Differential cryptanalysis. Advantage: I A sieving process ) smaller time complexity Disadvantage: I Subset of output space ) not all information I Small Probabilities ) Non-tightness of the information 17/27
24 Balanced Partitioning Idea: Using information from all output differences by grouping them. Let V =[ (i) out ] i a subspace of F m 2 A group of differences (i) out = (i) out V ( V V = F m 2 ) A counter qi k for each group of differences. We increment the counter qi k if the difference 2 (i) out is obtained partial deciphering. 18/27
25 Balanced Partitioning: Last Round Attack in V?\ out = out V S 7 S 6 S 5 S 4 S 3 S 2 S 1 S 0 Substitution Layer k 7 e k 6 e k 5 e k 4 e k 3 e k 2 e k 1 e k 0 e 19/27
26 Balanced Partitioning: Last Round Attack V \ out = out V S 7 S 6 S 5 S 4 S 3 S 2 S 1 S 0 Active Sboxes k 7 e k 6 e k 5 e k 4 e k 3 e k 2 e k 1 e k 0 e 19/27
27 Balanced Partitioning: Last Round Attack V \ S 7 S 6 S 5 S 4 S 3 S 2 S 1 S 0 k 7 e k 6 e k 5 e k 4 e k 3 e k 2 e k 1 e k 0 e No Sieving process Partially decipher for all pairs 19/27
28 Balanced Partitioning: Last Round Attack V \ S 7 S 6 S 5 S 4 S 3 S 2 S 1 S 0 For all key candidates, k 7 e k 6 e k 5 e k 4 6 e k 3 6 e k 2 6 e k 1 e k 0 e partially decipher 19/27
29 Balanced Partitioning: Last Round Attack V \ * 6 Y S 7 S 6 S 5 S 4 S 3 S 2 S 1 S 0 k 7 e k 6 e k 5 e k 4 6 e k 3 6 e k 2 6 e k 1 e k 0 e If 2 (i) out V Increment q k i 19/27
30 Balanced Partitioning: Last Round Attack V \ * 6 Y S 7 S 6 S 5 S 4 S 3 S 2 S 1 S 0 k 7 e k 6 e k 5 e k 4 6 e k 3 6 e k 2 6 e k 1 e k 0 e If 2 (i) out V Increment q k i Analyse the vectors q k for each key Scoring function 19/27
31 Balanced Partitioning: Remarks Corresponding known/former attacks: I Truncated Differential cryptanalysis. Advantage: I Whole output space ) More information I Bigger Probabilities ) Tightness of the information Disadvantage: I No sieving process ) More time complexity 20/27
32 Statistical Tests Probability distribution vectors I Expected: p =[pv] v2v I Uniform: I Observed: q k (for a given key candidate) LLR test: requires the knowledge of the theoretical probability p. S k = LLR k (q k, p, ) def X p = Ns q v k v log. v2v v 2 test: Does not require the knowledge of p for the attack X S k = 2 k (qk, )=Ns v2v (q k v v) 2 v. 2 Statistics 21/27
33 Complexities Let S(k) be the statistic obtained for a key candidate k. S(k) =LLR k (q k, p, ) or = 2 k (qk, ) Then, In the paper: N (µr, 2 S(k) R ) if k = K r, N (µ W, 2 W ) otherwise. I Estimates of the value of µ R,µ W, R, w for both LLR and 2 statistical tests. I Estimates of the Data Complexity 22/27
34 Outline Introduction Block Ciphers Differential Cryptanalysis Last Round Attacks Multiple Differential Cryptanalysis Definition Partitioning Function Complexities Experiments Experimental Results Analyse 23/27
35 Using unbalanced partitioning Subset of output differences P S log 2 (N) LLR : Ex. a = 4 Th. a = 4 Ex. a = 11 Th. a = 11 2 : Ex. a = 4 Th. a = 4 Ex. a = 11 Th. a = 11 24/27
36 Using balanced partitioning Set of groups of output differences P S LLR : Ex. a = 4 Th. a = 4 Ex. a = 7 Th. a = 7 2 : Ex. a = 4 Th. a = 4 Ex. a = 7 Th. a = log 2 (N) 25/27
37 Conclusions Balanced or Unbalanced partitioning? I Time Complexity: unbalanced ) faster attack. I Data Complexity: depends on the cipher. LLR or 2? I If we have a good estimate of the expected probabilities ) LLR provides better Data and Memory complexities I Otherwise LLR is not effective 26/27
38 Work in Progress Estimation of the Differential Probabilities In Theory I Estimation of truncated differential probabilities can be done correlations. In Practice I Estimation of the correlations are easy on PRESENT CO I We use them to compute the distribution vector. I We provide a multiple differential attack on PRESENT 27/27
Data complexity and success probability of statisticals cryptanalysis
Data complexity and success probability of statisticals cryptanalysis Céline Blondeau SECRET-Project-Team, INRIA, France Joint work with Benoît Gérard and Jean-Pierre Tillich aaa C.Blondeau Data complexity
More informationMultiple Differential Cryptanalysis: Theory and Practice
Multiple Differential Cryptanalysis: Theory and Practice Céline Blondeau, Benoît Gérard SECRET-Project-Team, INRIA, France aaa FSE, February 14th, 2011 C.Blondeau and B.Gérard. Multiple differential cryptanalysis
More informationLinks Between Theoretical and Effective Differential Probabilities: Experiments on PRESENT
Links Between Theoretical and Effective Differential Probabilities: Experiments on PRESENT Céline Blondeau, Benoît Gérard SECRET-Project-Team, INRIA, France TOOLS for Cryptanalysis - 23th June 2010 C.Blondeau
More informationThe Improbable Differential Attack. Cryptanalysis of Reduced Round CLEFIA
: Cryptanalysis of Reduced Round CLEFIA École Polytechnique Fédérale de Lausanne, Switzerland (This work was done at) Institute of Applied Mathematics Middle East Technical University, Ankara, Turkey INDOCRYPT
More informationData Complexity and Success Probability for Various Cryptanalyses
Data Complexity and Success Probability for Various Cryptanalyses Céline Blondeau, Benoît Gérard and Jean Pierre Tillich INRIA project-team SECRET, France Blondeau, Gérard and Tillich. Data Complexity
More informationZero-Correlation Linear Cryptanalysis of Reduced-Round LBlock
Zero-Correlation Linear Cryptanalysis of Reduced-Round LBlock Hadi Soleimany and Kaisa Nyberg Department of Information and Computer Science, Aalto University School of Science, Finland WCC 2013 1/53 Outline
More informationProvable Security Against Differential and Linear Cryptanalysis
Provable Security Against Differential and Linear Cryptanalysis Kaisa Nyberg Department of Information and Computer Science Aalto University Introduction CRADIC Linear Hull SPN and Two Strategies Highly
More informationLinks Between Truncated Differential and Multidimensional Linear Properties of Block Ciphers and Underlying Attack Complexities
Links Between Truncated Differential and Multidimensional Linear Properties of Block Ciphers and Underlying Attack Complexities Céline Blondeau and Kaisa Nyberg Department of Information and Computer Science,
More informationImprobable Differential Cryptanalysis and Undisturbed Bits
Improbable Differential Cryptanalysis and Undisturbed Bits Institute of Applied Mathematics Department of Cryptography Middle East Technical University September 5, 2013 Leuven, Belgium A (Very) Short
More informationOn Distinct Known Plaintext Attacks
Céline Blondeau and Kaisa Nyberg Aalto University Wednesday 15th of April WCC 2015, Paris Outline Linear Attacks Data Complexity of Zero-Correlation Attacks Theory Experiments Improvement of Attacks Multidimensional
More informationCryptanalysis of PRESENT-like ciphers with secret S-boxes
Cryptanalysis of PRESENT-like ciphers with secret S-boxes Julia Borghoff Lars Knudsen Gregor Leander Søren S. Thomsen DTU, Denmark FSE 2011 Cryptanalysis of Maya Julia Borghoff Lars Knudsen Gregor Leander
More informationLinear Cryptanalysis of Long-Key Iterated Cipher with Applications to Permutation-Based Ciphers
Linear Cryptanalysis of Long-Key Iterated Cipher with Applications to Permutation-Based Ciphers Kaisa Nyberg Aalto University School of Science kaisa.nyberg@aalto.fi Luxemburg January 2017 Outline Introduction
More informationExperimenting Linear Cryptanalysis
Experimenting Linear Cryptanalysis Baudoin Collard, François-Xavier Standaert UCL Crypto Group, Microelectronics Laboratory, Université catholique de Louvain. Place du Levant 3, B-1348, Louvain-la-Neuve,
More informationIntegrals go Statistical: Cryptanalysis of Full Skipjack Variants
Integrals go Statistical: Cryptanalysis of ull Skipjack Variants Meiqin Wang mqwang@sdu.edu.cn Joint Work with Tingting Cui, Huaifeng Chen, Ling Sun, Long Wen, Andrey Bogdanov Shandong University, China;
More informationAlgebraic Techniques in Differential Cryptanalysis
Algebraic Techniques in Differential Cryptanalysis Martin Albrecht and Carlos Cid Information Security Group, Royal Holloway, University of London FSE 2009, Leuven, 24.02.2009 Martin Albrecht and Carlos
More informationEnhancing the Signal to Noise Ratio
Enhancing the Signal to Noise Ratio in Differential Cryptanalysis, using Algebra Martin Albrecht, Carlos Cid, Thomas Dullien, Jean-Charles Faugère and Ludovic Perret ESC 2010, Remich, 10.01.2010 Outline
More informationImproved Linear (hull) Cryptanalysis of Round-reduced Versions of SIMON
Improved Linear (hull) Cryptanalysis of Round-reduced Versions of SIMON Danping Shi 1,2, Lei Hu 1,2, Siwei Sun 1,2, Ling Song 1,2, Kexin Qiao 1,2, Xiaoshuang Ma 1,2 1 State Key Laboratory of Information
More informationLinear Cryptanalysis Using Multiple Linear Approximations
Linear Cryptanalysis Using Multiple Linear Approximations Miia HERMELIN a, Kaisa NYBERG b a Finnish Defence Forces b Aalto University School of Science and Nokia Abstract. In this article, the theory of
More informationA New Technique for Multidimensional Linear Cryptanalysis with Applications on Reduced Round Serpent
A New Technique for Multidimensional Linear Cryptanalysis with Applications on Reduced Round Serpent Joo Yeon Cho, Miia Hermelin, and Kaisa Nyberg Helsinki University of Technology, Department of Information
More informationLinear and Statistical Independence of Linear Approximations and their Correlations
Linear and Statistical Independence of Linear Approximations and their Correlations Kaisa Nyberg Aalto University School of Science kaisa.nyberg@aalto.fi Boolean Functions and their Applications Os, Norway,
More informationChapter 1 - Linear cryptanalysis.
Chapter 1 - Linear cryptanalysis. James McLaughlin 1 Introduction. Linear cryptanalysis was first introduced by Mitsuru Matsui in [12]. The cryptanalyst attempts to find a linear equation x 1... x i =
More informationDifferential-Linear Cryptanalysis of Serpent
Differential-Linear Cryptanalysis of Serpent Eli Biham, 1 Orr Dunkelman, 1 Nathan Keller 2 1 Computer Science Department, Technion. Haifa 32000, Israel {biham,orrd}@cs.technion.ac.il 2 Mathematics Department,
More informationIntegral and Multidimensional Linear Distinguishers with Correlation Zero
Integral and Multidimensional Linear Distinguishers with Correlation Zero Andrey Bogdanov 1, regor Leander 2, Kaisa yberg 3, Meiqin Wang 4 1 KU Leuven, ESAT/SCD/COSIC and IBBT, Belgium 2 Technical University
More informationImproved Differential-Linear Cryptanalysis of 7-round Chaskey with Partitioning
Improved Differential-Linear Cryptanalysis of 7-round Chaskey with Partitioning Gaëtan Leurent Inria, France Abstract. In this work we study the security of Chaskey, a recent lightweight MAC designed by
More informationWieringa, Celine; Nyberg, Kaisa Improved Parameter Estimates for Correlation and Capacity Deviates in Linear Cryptanalysis
Powered by TCPDF (www.tcpdf.org) This is an electronic reprint of the original article. This reprint may differ from the original in pagination and typographic detail. Wieringa, Celine; Nyberg, Kaisa Improved
More informationSymmetric Cryptanalytic Techniques. Sean Murphy ショーン マーフィー Royal Holloway
Symmetric Cryptanalytic Techniques Sean Murphy ショーン マーフィー Royal Holloway Block Ciphers Encrypt blocks of data using a key Iterative process ( rounds ) Modified by Modes of Operation Data Encryption Standard
More informationLinear Cryptanalysis of Reduced-Round PRESENT
Linear Cryptanalysis of Reduced-Round PRESENT Joo Yeon Cho 1 Helsinki University of Technology, Finland 2 Nokia A/S, Denmark joo.cho@tkk.fi Abstract. PRESENT is a hardware-oriented block cipher suitable
More informationBlock Cipher Cryptanalysis: An Overview
0/52 Block Cipher Cryptanalysis: An Overview Subhabrata Samajder Indian Statistical Institute, Kolkata 17 th May, 2017 0/52 Outline Iterated Block Cipher 1 Iterated Block Cipher 2 S-Boxes 3 A Basic Substitution
More informationMultivariate Linear Cryptanalysis: The Past and Future of PRESENT
Multivariate Linear Cryptanalysis: The Past and Future of PRESENT Andrey Bogdanov, Elmar Tischhauser, and Philip S. Vejre Technical University of Denmark, Denmark {anbog,ewti,psve}@dtu.dk June 29, 2016
More informationExperiments on the Multiple Linear Cryptanalysis of Reduced Round Serpent
Experiments on the Multiple Linear Cryptanalysis of Reduced Round Serpent B. Collard, F.-X. Standaert, J.-J. Quisquater UCL Crypto Group Microelectronics Laboratory Catholic University of Louvain - UCL
More informationA Unified Method for Finding Impossible Differentials of Block Cipher Structures
A Unified Method for inding Impossible Differentials of Block Cipher Structures Yiyuan Luo 1,2, Zhongming Wu 1, Xuejia Lai 1 and Guang Gong 2 1 Department of Computer Science and Engineering, Shanghai
More informationSubspace Trail Cryptanalysis and its Applications to AES
Subspace Trail Cryptanalysis and its Applications to AES Lorenzo Grassi, Christian Rechberger and Sondre Rønjom March, 2017 1 / 28 Introduction In the case of AES, several alternative representations (algebraic
More informationImproved Multiple Impossible Differential Cryptanalysis of Midori128
Improved Multiple Impossible Differential Cryptanalysis of Midori128 Mohamed Tolba, Ahmed Abdelkhalek, and Amr M. Youssef Concordia Institute for Information Systems Engineering, Concordia University,
More informationProvable Security Against Differential and Linear Cryptanalysis
Provable Security Against Differential and Linear Cryptanalysis Kaisa Nyberg Aalto University School of Science and Nokia, Finland kaisa.nyberg@aalto.fi Abstract. In this invited talk, a brief survey on
More informationLinear Cryptanalysis
Linear Cryptanalysis Linear cryptanalysis is a powerful method of cryptanalysis introduced by Matsui in 1993 [11]. It is a known plaintext attack in which the attacker studies the linear approximations
More informationImproved Impossible Differential Cryptanalysis of Rijndael and Crypton
Improved Impossible Differential Cryptanalysis of Rijndael and Crypton Jung Hee Cheon 1, MunJu Kim 2, Kwangjo Kim 1, Jung-Yeun Lee 1, and SungWoo Kang 3 1 IRIS, Information and Communications University,
More informationTowards Provable Security of Substitution-Permutation Encryption Networks
Towards Provable Security of Substitution-Permutation Encryption Networks Zhi-Guo Chen and Stafford E. Tavares Department of Electrical and Computer Engineering Queen s University at Kingston, Ontario,
More informationZero-Correlation Linear Cryptanalysis with Fast Fourier Transform and Applications to Camellia and CLEFIA
Zero-Correlation Linear Cryptanalysis with Fast Fourier Transform and Applications to Camellia and CLEFIA Andrey Bogdanov, Meiqin Wang Technical University of Denmark, Shandong University, China ESC 2013,
More informationDistinguishing Attacks on a Kind of Generalized Unbalanced Feistel Network
Distinguishing Attacks on a Kind of Generalized Unbalanced Feistel Network Ruilin Li, Bing Sun, and Chao Li Department of Mathematics and System Science, Science College, National University of Defense
More informationRevisit and Cryptanalysis of a CAST Cipher
2017 3rd International Conference on Electronic Information Technology and Intellectualization (ICEITI 2017) ISBN: 978-1-60595-512-4 Revisit and Cryptanalysis of a CAST Cipher Xiao Zhou, Jingwei Li, Xuejia
More informationSome attacks against block ciphers
Some attacks against block ciphers hristina Boura École de printemps en codage et cryptographie May 19, 2016 1 / 59 Last-round attacks Outline 1 Last-round attacks 2 Higher-order differential attacks 3
More informationHermelin, Miia; Cho, Joo Yeon; Nyberg, Kaisa Multidimensional Linear Cryptanalysis
Powered by TCPDF (www.tcpdf.org) This is an electronic reprint of the original article. This reprint may differ from the original in pagination and typographic detail. Hermelin, Miia; Cho, Joo Yeon; Nyberg,
More informationAnother Look at Normal Approximations in Cryptanalysis
Another Look at Normal Approximations in Cryptanalysis Subhabrata Samajder and Palash Sarkar Applied Statistics Unit Indian Statistical Institute 203, B.T.Road, Kolkata, India - 700108. {subhabrata r,palash}@isical.ac.in
More informationStatistical and Algebraic Properties of DES
Statistical and Algebraic Properties of DES Stian Fauskanger 1 and Igor Semaev 2 1 Norwegian Defence Research Establishment (FFI), PB 25, 2027 Kjeller, Norway 2 Department of Informatics, University of
More informationLinear Cryptanalysis of DES with Asymmetries
Linear Cryptanalysis of DES with Asymmetries Andrey Bogdanov and Philip S. Vejre Technical University of Denmark {anbog,psve}@dtu.dk Abstract. Linear cryptanalysis of DES, proposed by Matsui in 1993, has
More informationImproving the Time Complexity of Matsui s Linear Cryptanalysis
Improving the Time Complexity of Matsui s Linear Cryptanalysis B. Collard, F.-X. Standaert, J.-J. Quisquater UCL Crypto Group, Université Catholique de Louvain Abstract. This paper reports on an improvement
More informationChapter 2 - Differential cryptanalysis.
Chapter 2 - Differential cryptanalysis. James McLaughlin 1 Introduction. Differential cryptanalysis, published in 1990 by Biham and Shamir [5, 6], was the first notable cryptanalysis technique to be discovered
More informationOn the Wrong Key Randomisation and Key Equivalence Hypotheses in Matsui s Algorithm 2
On the Wrong Key Randomisation and Key Equivalence Hypotheses in Matsui s Algorithm 2 Andrey Bogdanov 1 and Elmar Tischhauser 2 1 Technical University of Denmark anbog@dtu.dk 2 KU Leuven and iminds, Belgium
More informationLinear Cryptanalysis of RC5 and RC6
Linear Cryptanalysis of RC5 and RC6 Johan Borst, Bart Preneel, and Joos Vandewalle K.U. Leuven, Dept. Elektrotechniek-ESAT/COSIC Kardinaal Mercierlaan 94, B-3001 Heverlee Belgium Johan.Borst@esat.kuleuven.ac.be
More informationPublication VII Springer Science+Business Media. Reprinted with kind permission from Springer Science and Business Media.
Publication VII Miia Hermelin and Kaisa Nyberg. 2010. Dependent linear approximations: The algorithm of Biryukov and others revisited. In: Josef Pieprzyk (editor). Topics in Cryptology. Proceedings of
More informationMultidimensional Extension of Matsui s Algorithm 2
Multidimensional Extension of Matsui s Algorithm 2 Miia Hermelin 1, Joo Yeon Cho 1, and Kaisa Nyberg 12 1 Helsinki University of Technology 2 Nokia Research Center, Finland Abstract. Matsui s one-dimensional
More informationStructural Evaluation of AES and Chosen-Key Distinguisher of 9-round AES-128
Structural Evaluation of AES and Chosen-Key Distinguisher of 9-round AES-128 Pierre-Alain Fouque 1 Jérémy Jean 2 Thomas Peyrin 3 1 Université de Rennes 1, France 2 École Normale Supérieure, France 3 Nanyang
More informationLinear Cryptanalysis. Kaisa Nyberg. Department of Computer Science Aalto University School of Science. S3, Sackville, August 11, 2015
Kaisa Nyberg Department of Computer Science Aalto University School of Science s 2 r t S3, Sackville, August 11, 2015 Outline Linear characteristics and correlations Matsui s algorithms Traditional statistical
More informationOn Multiple Linear Approximations
On Multiple Linear Approximations Alex Biryukov, Christophe De Cannière, and Michael Quisquater Katholieke Universiteit Leuven, Dept. ESAT/SCD-COSIC, Kasteelpark Arenberg 10, B 3001 Leuven-Heverlee, Belgium
More informationAn average case analysis of a dierential attack. on a class of SP-networks. Distributed Systems Technology Centre, and
An average case analysis of a dierential attack on a class of SP-networks Luke O'Connor Distributed Systems Technology Centre, and Information Security Research Center, QUT Brisbane, Australia Abstract
More informationDivision Property: a New Attack Against Block Ciphers
Division Property: a New Attack Against Block Ciphers Christina Boura (joint on-going work with Anne Canteaut) Séminaire du groupe Algèbre et Géometrie, LMV November 24, 2015 1 / 50 Symmetric-key encryption
More informationRevisiting the Wrong-Key-Randomization Hypothesis
Revisiting the Wrong-Key-Randomization Hypothesis Tomer Ashur, Tim Beyne, and Vincent Rijmen ESAT/COSIC, KU Leuven and iminds, Leuven, Belgium [tomer.ashur,vincent.rijmen] @ esat.kuleuven.be [tim.beyne]
More informationImproved Cryptanalysis of Py
Improved Cryptanalysis of Py Paul Crowley LShift Ltd State of the Art in Stream Ciphers 2006 Py estream entrant by Eli Biham and Jennifer Seberry Fast in software (2.6 cycles/byte on some platforms) SPP
More informationDifferential Fault Analysis on DES Middle Rounds
Differential Fault Analysis on DES Middle Rounds Matthieu Rivain Speaker: Christophe Giraud Oberthur Technologies Agenda 1 Introduction Data Encryption Standard DFA on DES Last & Middle Rounds 2 Our Attack
More informationS-box (Substitution box) is a basic component of symmetric
JOURNAL OF L A TEX CLASS FILES, VOL., NO., AUGUST 1 Characterizations of the Degraded Boolean Function and Cryptanalysis of the SAFER Family Wentan Yi and Shaozhen Chen Abstract This paper investigates
More informationOn Correlation Between the Order of S-boxes and the Strength of DES
On Correlation Between the Order of S-boxes and the Strength of DES Mitsuru Matsui Computer & Information Systems Laboratory Mitsubishi Electric Corporation 5-1-1, Ofuna, Kamakura, Kanagawa, 247, Japan
More informationDifferential Attack on Five Rounds of the SC2000 Block Cipher
Differential Attack on Five Rounds of the SC2 Block Cipher Jiqiang Lu Department of Mathematics and Computer Science, Eindhoven University of Technology, 56 MB Eindhoven, The Netherlands lvjiqiang@hotmail.com
More informationDK-2800 Lyngby, Denmark, Mercierlaan 94, B{3001 Heverlee, Belgium,
The Interpolation Attack on Block Ciphers? Thomas Jakobsen 1 and Lars R. Knudsen 2 1 Department of Mathematics, Building 303, Technical University of Denmark, DK-2800 Lyngby, Denmark, email:jakobsen@mat.dtu.dk.
More informationPermutation Generators Based on Unbalanced Feistel Network: Analysis of the Conditions of Pseudorandomness 1
Permutation Generators Based on Unbalanced Feistel Network: Analysis of the Conditions of Pseudorandomness 1 Kwangsu Lee A Thesis for the Degree of Master of Science Division of Computer Science, Department
More informationLinks among Impossible Differential, Integral and Zero Correlation Linear Cryptanalysis
Links among Impossible Differential, Integral and Zero Correlation Linear Cryptanalysis Bing Sun 1,3, Zhiqiang Liu 2,3,, Vincent Rijmen 3, Ruilin Li 4, Lei Cheng 1, Qingju Wang 2,3, Hoda Alkhzaimi 5, Chao
More informationDifferential Analaysis of Block Ciphers SIMON and SPECK
1 / 36 Differential Analaysis of Block Ciphers SIMON and SPECK Alex Biryukov, Arnab Roy, Vesselin Velichkov 2 / 36 Outline Introduction Light-Weight Block Ciphers: SIMON and SPECK Differential Anlaysis
More informationMATH 509 Differential Cryptanalysis on DES
MATH 509 on DES Department of Mathematics, Boise State University Spring 2012 MATH 509 on DES MATH 509 on DES Feistel Round Function for DES MATH 509 on DES 1977: DES is approved as a standard. 1 1 Designers:
More informationImpossible differential and square attacks: Cryptanalytic link and application to Skipjack
UCL Crypto Group Technical Report Series Impossible differential and square attacks: Cryptanalytic link and application to Skipjack Gilles Piret Jean-Jacques Quisquater REGARDS GROUPE http://www.dice.ucl.ac.be/crypto/
More informationDES S-box Generator. 2 EPFL, Switzerland
DES S-box Generator Lauren De Meyer 1 and Serge Vaudenay 2 lauren.demeyer@student.kuleuven.be serge.vaudenay@epfl.ch 1 KU Leuven, Belgium 2 EPFL, Switzerland Abstract. The Data Encryption Standard (DES)
More informationOptimized Interpolation Attacks on LowMC
Optimized Interpolation Attacks on LowMC Itai Dinur 1, Yunwen Liu 2, Willi Meier 3, and Qingju Wang 2,4 1 Département d Informatique, École Normale Supérieure, Paris, France 2 Dept. Electrical Engineering
More informationImpossible Differential Cryptanalysis of Mini-AES
Impossible Differential Cryptanalysis of Mini-AES Raphael Chung-Wei Phan ADDRESS: Swinburne Sarawak Institute of Technology, 1 st Floor, State Complex, 93576 Kuching, Sarawak, Malaysia. rphan@swinburne.edu.my
More informationSimilarities between encryption and decryption: how far can we go?
Similarities between encryption and decryption: how far can we go? Anne Canteaut Inria, France and DTU, Denmark Anne.Canteaut@inria.fr http://www-rocq.inria.fr/secret/anne.canteaut/ SAC 2013 based on a
More informationLecture 12: Block ciphers
Lecture 12: Block ciphers Thomas Johansson T. Johansson (Lund University) 1 / 19 Block ciphers A block cipher encrypts a block of plaintext bits x to a block of ciphertext bits y. The transformation is
More informationKFC - The Krazy Feistel Cipher
KFC - The Krazy Feistel Cipher Thomas Baignères and Matthieu Finiasz EPFL CH-1015 Lausanne Switzerland http://lasecwww.epfl.ch Abstract. We introduce KFC, a block cipher based on a three round Feistel
More informationBISON Instantiating the Whitened Swap-Or-Not Construction November 14th, 2018
BION Instantiating the Whitened wap-or-not Construction November 14th, 2018 FluxFingers Workgroup ymmetric Cryptography, Ruhr University Bochum Virginie Lallemand, Gregor Leander, Patrick Neumann, and
More informationThesis Research Notes
Thesis Research Notes Week 26-2012 Christopher Wood June 29, 2012 Abstract This week was devoted to reviewing some classical literature on the subject of Boolean functions and their application to cryptography.
More informationComplementing Feistel Ciphers
Complementing Feistel Ciphers Alex Biryukov 1 and Ivica Nikolić 2 1 University of Luxembourg 2 Nanyang Technological University, Singapore alex.biryukov@uni.lu inikolic@ntu.edu.sg Abstract. In this paper,
More informationLinear Cryptanalysis of Reduced-Round Speck
Linear Cryptanalysis of Reduced-Round Speck Tomer Ashur Daniël Bodden KU Leuven and iminds Dept. ESAT, Group COSIC Address Kasteelpark Arenberg 10 bus 45, B-3001 Leuven-Heverlee, Belgium tomer.ashur-@-esat.kuleuven.be
More informationA Five-Round Algebraic Property of the Advanced Encryption Standard
A Five-Round Algebraic Property of the Advanced Encryption Standard Jianyong Huang, Jennifer Seberry and Willy Susilo Centre for Computer and Information Security Research (CCI) School of Computer Science
More informationCryptanalysis of the SIMON Family of Block Ciphers
Cryptanalysis of the SIMON Family of Block Ciphers Hoda A. Alkhzaimi and Martin M. Lauridsen DTU Compute Section for Cryptology Department of Applied Mathematics and Computer Science Matematiktorvet, building
More informationLinear Cryptanalysis: Key Schedules and Tweakable Block Ciphers
Linear Cryptanalysis: Key Schedules and Tweakable Block Ciphers Thorsten Kranz, Gregor Leander, Friedrich Wiemer Horst Görtz Institute for IT Security, Ruhr University Bochum Block Cipher Design k KS m
More informationThe Invariant Set Attack 26th January 2017
The Invariant Set Attack 26th January 2017 Workgroup Symmetric Cryptography Ruhr University Bochum Friedrich Wiemer Friedrich Wiemer The Invariant Set Attack 26th January 2017 1 Nonlinear Invariant Attack
More informationImproved Impossible Differential Attack on Reduced Version of Camellia-192/256
Improved Impossible Differential ttack on educed Version of Camellia-92/256 Ya iu, Dawu Gu, Zhiqiang iu, Wei i 2,3 Department of Computer Science and Engineering, Shanghai Jiao Tong University, Shanghai
More informationCryptanalysis of a Generalized Unbalanced Feistel Network Structure
Cryptanalysis of a Generalized Unbalanced Feistel Network Structure Ruilin Li 1, Bing Sun 1, Chao Li 1,2, and Longjiang Qu 1,3 1 Department of Mathematics and System Science, Science College, National
More informationNew Results on Boomerang and Rectangle Attacks
New Results on Boomerang and Rectangle Attacks Eli Biham, 1 Orr Dunkelman, 1 Nathan Keller 2 1 Computer Science Department, Technion. Haia 32000, Israel {biham,orrd}@cs.technion.ac.il 2 Mathematics Department,
More informationDifferential Attacks: Using Alternative Operations
Differential Attacks: Using Alternative Operations Céline Blondeau 1, Roberto Civino 2, and Massimiliano Sala 2 1 Aalto University, School of Science, Finland celine.blondeau@aalto.fi 2 University of Trento,
More informationImpossible Differential Attacks on 13-Round CLEFIA-128
Mala H, Dakhilalian M, Shakiba M. Impossible differential attacks on 13-round CLEFIA-128. JOURNAL OF COMPUTER SCIENCE AND TECHNOLOGY 26(4): 744 750 July 2011. DOI 10.1007/s11390-011-1173-0 Impossible Differential
More informationCryptanalysis of Patarin s 2-Round Public Key System with S Boxes (2R)
Cryptanalysis of Patarin s 2-Round Public Key System with S Boxes (2R) Eli Biham Computer Science Department Technion Israel Institute of Technology Haifa 32000, Israel biham@cs.technion.ac.il http://www.cs.technion.ac.il/~biham/
More informationAutomatic Search of Truncated Impossible Differentials for Word-Oriented Block Ciphers (Full Version)
Automatic Search of Truncated Impossible Differentials for Word-Oriented Block Ciphers (Full Version) Shengbao Wu 1,2, Mingsheng Wang 3 1. Institute of Software, Chinese Academy of Sciences, Beijing 100190,
More information3-6 On Multi Rounds Elimination Method for Higher Order Differential Cryptanalysis
3-6 On Multi Rounds Elimination Method for Higher Order Differential Cryptanalysis TANAKA Hidema, TONOMURA Yuji, and KANEKO Toshinobu A multi rounds elimination method for higher order differential cryptanalysis
More informationAbstract Differential and linear cryptanalysis, two of the most important techniques in modern block cipher cryptanalysis, still lack a sound, general
On Probability of Success in Differential and Linear Cryptanalysis Ali Ayd n Selοcuk 1 Network Systems Lab, Department of Computer Science, and Center for Education and Research in Information Assurance
More informationLinear Hull Attack on Round-Reduced Simeck with Dynamic Key-guessing Techniques
Linear Hull Attack on Round-Reduced Simeck with Dynamic Key-guessing Techniques Lingyue Qin 1, Huaifeng Chen 3, Xiaoyun Wang 2,3 1 Department of Computer Science and Technology, Tsinghua University, Beijing
More informationBit-Pattern Based Integral Attack
Bit-Pattern Based Integral Attack Muhammad Reza Z aba 1,Håvard Raddum 2,,MattHenricksen 3, and Ed Dawson 1 1 Information Security Institute, Queensland University of Technology, GPO Box 2434, Brisbane,
More informationIntroduction on Block cipher Yoyo Game Application on AES Conclusion. Yoyo Game with AES. Navid Ghaedi Bardeh. University of Bergen.
Yoyo Game with AES Navid Ghaedi Bardeh University of Bergen May 8, 2018 1 / 33 Outline 1 Introduction on Block cipher 2 Yoyo Game 3 Application on AES 4 Conclusion 2 / 33 Classical Model of Symmetric Cryptography
More informationAlgebraic properties of SHA-3 and notable cryptanalysis results
Algebraic properties of SHA-3 and notable cryptanalysis results Christina Boura University of Versailles, France ICMC 2015, January 9, 2014 1 / 51 Cryptographic Hash Functions H : {0,1} {0,1} n m H h =
More informationON DISTINGUISHING ATTACK AGAINST THE REDUCED VERSION OF THE CIPHER NLSV2
t m Mathematical Publications DOI: 10.2478/v10127-012-0037-5 Tatra Mt. Math. Publ. 53 (2012), 21 32 ON DISTINGUISHING ATTACK AGAINST THE REDUCED VERSION OF THE CIPHER NLSV2 Michal Braško Jaroslav Boor
More informationImproved characteristics for differential cryptanalysis of hash functions based on block ciphers
1 Improved characteristics for differential cryptanalysis of hash functions based on block ciphers Vincent Rijmen Bart Preneel Katholieke Universiteit Leuven ESAT-COSIC K. Mercierlaan 94, B-3001 Heverlee,
More informationCiphertext-only Cryptanalysis of a Substitution Permutation Network
Ciphertext-only Cryptanalysis of a Substitution Permutation Network No Author Given No Institute Given Abstract. We present the first ciphertext-only cryptanalytic attack against a substitution permutation
More informationCube Attacks on Stream Ciphers Based on Division Property
Cube Attacks on Stream Ciphers Based on Division Property Chaoyun Li ESAT-COSIC, KU Leuven 12-10-2017, Crete Chaoyun Li (ESAT-COSIC, KU Leuven) Cube attacks 12-10-2017, Crete 1 / 23 Plan 1 Cube Attack:
More informationDistinguishers for the Compression Function and Output Transformation of Hamsi-256
Distinguishers for the Compression Function and Output Transformation of Hamsi-256 Jean-Philippe Aumasson Emilia Käsper Lars Ramkilde Knudsen Krystian Matusiewicz Rune Ødegård Thomas Peyrin Martin Schläffer
More information